PT-2026-104718

A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE PAYMENT INSTALLED leads to code injection. The attack can be executed remotely...

PT-2026-104719

A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible...

CVE-2026-105135

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit...

CVE-2026-105135

The InternLM MindSearch software (version 0.1.0 ) contains a code injection vulnerability within the Planner Agent component. Specifically, the ExecutionAction.run function in the file mindsearch/agent/graph.py is affected. The root cause is the improper handling of argument inputs , which allows...

CVE-2026-105135 InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit...

EUVD-2026-92077

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit...

CVE-2026-105135 InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit...

Ivanti EPM Cloud Services Appliance Code Injection

Ivanti EPM Cloud Services Appliance CSA before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions nobody. id: CVE-2021-44529 info: name: Ivanti EPM Cloud Services Appliance Code Injection...

CVE-2026-105135: Improper Control of Generation of Code

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit...

PT-2026-104580

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The OAuth2 Provider PKCE enforcement is only applied to authorization requests where the response type is exactly code. Consequently, codes issued via OpenID Connect hybrid flows such as code token,...

GHSA-JQMF-MX4F-HFR6 Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Summary: 5 findings — BashTool shell-injection sink F6, the canonical RCE primitive, BackgroundRunTool async shell-injection sink F7, backtest execmodule runs top-level statements before the SignalEngine class check F8 — independent RCE path that does not match BashTool signatures, readurl outbou...

Arbitrary Code Injection

Overview fsspec is a File-system specification Affected versions of this package are vulnerable to Arbitrary Code Injection in the reference filesystem process. An attacker can execute arbitrary code by tricking an application into loading a maliciously crafted reference document, such as a...

CVE-2026-51922

agentscope v1.0.20 contains code injection in executeshellcommand src/agentscope/tool/coding/shell.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-51911

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-51917

FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modifycode...

CVE-2026-51918

FinRobot 1.0.0 contains code injection in CodingUtils.createfilewithcode...

CVE-2026-51898

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...

CVE-2026-10026

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...

CVE-2026-10026 CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...

CVE-2026-10026 CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...